[audit] Security, code quality, missing tests, error handling #1

New issue

Open

opened 2026-03-22 16:41:20 +00:00 by Virgil · 1 comment

Virgil commented

2026-03-22 16:41:20 +00:00

Member

Full audit:

Security: SQL injection, XSS, CSRF bypass, mass assignment, path traversal, insecure deserialization
Code quality: missing strict_types, missing type hints, missing return types
Missing tests: modules/actions without Pest test coverage
Error handling: swallowed exceptions, bare try/catch, missing validation
UK English: American spellings (color→colour, organization→organisation, center→centre)
Coding standards: PSR-12 compliance, Action pattern usage, BelongsToWorkspace scoping
Missing SPDX licence headers (EUPL-1.2)

Report all findings with severity and file:line. Do NOT fix.

Full audit: 1. Security: SQL injection, XSS, CSRF bypass, mass assignment, path traversal, insecure deserialization 2. Code quality: missing strict_types, missing type hints, missing return types 3. Missing tests: modules/actions without Pest test coverage 4. Error handling: swallowed exceptions, bare try/catch, missing validation 5. UK English: American spellings (color→colour, organization→organisation, center→centre) 6. Coding standards: PSR-12 compliance, Action pattern usage, BelongsToWorkspace scoping 7. Missing SPDX licence headers (EUPL-1.2) Report all findings with severity and file:line. Do NOT fix.

Virgil commented

2026-03-22 19:32:07 +00:00

Author

Member

Codex Audit Findings

HIGH (3)

Package not auto-discoverable — no Laravel provider registration, Boot class never runs unless manually registered (composer.json:17)
Route file never loaded — Boot.php:60 never calls loadRoutesFrom(), /dashboard route is dead (client.php:25)
Layout hard-depends on Vite assets not in repo — breaks rendering outside monorepo (app.blade.php:16)

MEDIUM (2)

Sign-out wired as GET /logout — CSRF-able or breaks against Laravel's POST route (app.blade.php:66)
Namespace navigation dependencies

## Codex Audit Findings ### HIGH (3) 1. Package not auto-discoverable — no Laravel provider registration, Boot class never runs unless manually registered (composer.json:17) 2. Route file never loaded — Boot.php:60 never calls loadRoutesFrom(), /dashboard route is dead (client.php:25) 3. Layout hard-depends on Vite assets not in repo — breaks rendering outside monorepo (app.blade.php:16) ### MEDIUM (2) 4. Sign-out wired as GET /logout — CSRF-able or breaks against Laravel's POST route (app.blade.php:66) 5. Namespace navigation dependencies